circle-ir 4.7.2 → 4.9.7

package/dist/analysis/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAkgEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/analysis/config-loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACX,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAEjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAiB1E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG;IACtD,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC,CAcA;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,EAAE,GAC7B,kBAAkB,EAAE,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,qBAAqB,GAAE,MAAM,EAAO,GACnC,WAAW,CAYb;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAuwB1C,CAAC;AA+KF,eAAO,MAAM,aAAa,EAAE,WAAW,EAoiEtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAuiBhD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,kBAAkB,EAiDtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAO9C;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,EA8F5C,CAAC"}

package/dist/analysis/config-loader.js

@@ -2620,6 +2620,11 @@ export const DEFAULT_SINKS = [
     // ADO.NET `cmd.CommandText = "…" + x` — emitted as a synthetic call by
     // extractCSharpCalls (property-assignment sink; the ctor-arg sink misses it).
     { method: 'CommandText', type: 'sql_injection', cwe: 'CWE-89', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    // `DirectorySearcher.Filter = "(uid=" + x + ")"` — LDAP injection (cognium-ai#272).
+    // Emitted as a synthetic call by extractCSharpCalls ONLY when the receiver
+    // resolves to a DirectorySearcher, so this classless entry never over-matches
+    // other `.Filter =` assignments (DataView/BindingSource/collection filters).
+    { method: 'Filter', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // ADO.NET `cmd.Execute*()` — object-carried sink (cognium-dev#271). The taint
     // rides the SqlCommand receiver (CommandText set from tainted data); the
     // receiver is surfaced as arg[0] by extractCSharpCalls, and the command object
@@ -2636,6 +2641,9 @@ export const DEFAULT_SINKS = [
     // injectable — the second is the argv path where taint rides arg[1] (#276).
     { method: 'Start', class: 'Process', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1], languages: ['csharp'] },
     { method: 'ProcessStartInfo', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0, 1], languages: ['csharp'] },
+    // P/Invoke of libc `system(cmd)` — lowercase `system` in C# is virtually
+    // always the imported shell entry point (cognium-ai#275 interop/IlPinvoke).
+    { method: 'system', type: 'command_injection', cwe: 'CWE-78', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // C# path traversal — System.IO file APIs (CWE-22). Distinctive method names.
     { method: 'ReadAllText', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'ReadAllBytes', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2664,6 +2672,9 @@ export const DEFAULT_SINKS = [
     { method: 'Delete', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'GetFiles', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'EnumerateFiles', class: 'Directory', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // ASP.NET `ControllerBase.PhysicalFile(path, contentType)` serves a file from
+    // an absolute disk path — attacker-controllable path is CWE-22 (cognium-ai#326/#275).
+    { method: 'PhysicalFile', type: 'path_traversal', cwe: 'CWE-22', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# SSRF — HttpClient / WebClient / WebRequest (CWE-918).
     { method: 'GetAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'PostAsync', type: 'ssrf', cwe: 'CWE-918', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2688,6 +2699,17 @@ export const DEFAULT_SINKS = [
     { method: 'Load', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'LoadFrom', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     { method: 'LoadFile', class: 'Assembly', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    // C# server-side template injection (SSTI). Compiling an attacker-controlled
+    // template string is arbitrary code execution — classified as code_injection
+    // (CWE-94), matching how Python (Jinja2/Mako) and Node SSTI are modelled.
+    // Restricted to DISTINCTIVE template-compile APIs so the generic
+    // `Template.Parse` / `.Compile` names (int.Parse, Regex.Compile, …) are not
+    // over-matched. Taint-gated: a constant template never fires. `RunCompile`
+    // = RazorEngine; `CompileRenderStringAsync` = RazorLight; `Compile` is
+    // class-scoped to Handlebars. (cognium-dev#273)
+    { method: 'RunCompile', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
+    { method: 'CompileRenderStringAsync', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0, 1], languages: ['csharp'] },
+    { method: 'Compile', class: 'Handlebars', type: 'code_injection', cwe: 'CWE-94', severity: 'critical', arg_positions: [0], languages: ['csharp'] },
     // C# insecure deserialization — the polymorphic BCL formatters that can
     // instantiate arbitrary types named in the payload (CWE-502, cognium-ai#318).
     // Each of these classes exists only to deserialize and is unsafe on untrusted
@@ -2702,6 +2724,14 @@ export const DEFAULT_SINKS = [
     { method: 'Raw', class: 'Html', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Write', class: 'Response', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'HtmlString', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // Blazor `new MarkupString(x)` renders its argument as raw HTML (the framework's
+    // documented "trusted markup" escape hatch) — attacker-controlled input is XSS. (ca#275)
+    { method: 'MarkupString', class: 'constructor', type: 'xss', cwe: 'CWE-79', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // `String.Format(fmt, …)` with an attacker-controlled FORMAT string — CWE-134.
+    // Taint-gated on arg 0 (the format), so ordinary `String.Format("...", user)` where
+    // only an argument is tainted never fires. .NET composite formatting can't corrupt
+    // memory, so medium (FormatException DoS / unintended arg access), unlike C printf.
+    { method: 'Format', class: 'String', type: 'format_string', cwe: 'CWE-134', severity: 'medium', arg_positions: [0], languages: ['csharp'] },
     // C# LDAP injection — System.DirectoryServices (CWE-90). The user-built
     // filter is the constructor argument.
     { method: 'DirectorySearcher', type: 'ldap_injection', cwe: 'CWE-90', severity: 'high', arg_positions: [0], languages: ['csharp'] },
@@ -2740,6 +2770,10 @@ export const DEFAULT_SINKS = [
     { method: 'SelectSingleNode', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'SelectNodes', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Compile', class: 'XPathExpression', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    // XPathNavigator.Select/Evaluate — class-scoped (both names collide with LINQ
+    // `.Select`/`.Evaluate`, so they must resolve to an XPathNavigator receiver).
+    { method: 'Select', class: 'XPathNavigator', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
+    { method: 'Evaluate', class: 'XPathNavigator', type: 'xpath_injection', cwe: 'CWE-643', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     // C# XXE — untrusted XML into a parser without DTD hardening (CWE-611).
     { method: 'LoadXml', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },
     { method: 'Load', class: 'XmlDocument', type: 'xxe', cwe: 'CWE-611', severity: 'high', arg_positions: [0], languages: ['csharp'] },